Replace the Digital Certificate Used by Lasernet Config Server

To prevent temporary service interruptions caused by certificate expiry, it is crucial to replace the digital certificate used by Lasernet Config before its expiry date. We also recommend replacing the default certificate generated during installation with your own.

To import a new certificate issued by a certificate authority, you must acquire the certificate in PFX format. Else, a new self-signed certificate can be generated. However, we recommend that self-signed certificates are used only for test environments.

You can use a script to generate a new self-signed certificate (if necessary), import the new self-signed or certificate-authority-issued certificate into the Windows keystore, and bind the certificate to Lasernet Config.

This script:

• Generates a new self-signed certificate or imports an existing certificate.

• Exports the certificate to your Documents directory.

• Updates the Config Server bindings to use the new certificate for the specified host name and for localhost (when generating a self-signed certificate).

• Imports the certificate to the trusted root store (if using the ImportAsTrustedRoot switch).

• Clears down existing port/IP bindings to ensure the new certificate binds correctly.

Steps

To use the script, follow these steps:

1. Download and unzip the following ZIP file: https://lngsupportdownloads.blob.core.windows.net/lasernet/Tools/New-LNConfigServerCert_v1.2.zip. This file contains a .ps1 PowerShell script.

2. If Lasernet Config uses a certificate-authority-issued certificate: Acquire a new certificate in PFX format.

3. Remove the current certificate from the Windows keystore.

4. Start PowerShell and then run the New-LnConfigServerCert.ps1 script with appropriate parameters. Change the -LnVersion parameter value to match the Lasernet version. The following commands are examples of typical use:

   • Generate and use a self-signed certificate. The script assumes that the Config Server host name is the computer name.

     PS> .\New-LnConfigServerCert.ps1 -LnVersion 10

   • Generate and use a self-signed certificate that is valid for eight months and is for a specified host name.

     PS> .\New-LnConfigServerCert.ps1 -LnVersion 10 -CertHostName my.test.lasernetgroup.com -ValidMonths 8 -ImportAsTrustedRoot

   • Import an existing certificate from a keystore.

     PS> .\New-LnConfigServerCert.ps1 -LnVersion 10 -KeystorePath path\to\keystore.pfx -ImportAsTrustedRoot